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Quantum bit commitment has long been known to be impossible. Nevertheless, just as in the 
classical case, imposing certain constraints on the power of the parties may enable the construction of 
asymptotically secure protocols. Here, we introduce a quantum bit commitment protocol and prove 
that it is asymptotically secure if cheating is restricted to Gaussian operations. This protocol exploits 
continuous- variable quantum optical carriers, for which such a Gaussian constraint is experimentally 
relevant as the high optical nonlinearity needed to effect deterministic non-Gaussian cheating is 
inaccessible. 
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Quantum bit commitment (QBC) is probably one of 
most studied quantum cryptographic primitive, just af- 
ter quantum key distribution (see, e.g., [l|). It belongs to 
the class of mistrustful cryptography problems, which in- 
volve two parties (Alice and Bob) who do not trust each 
other. More specifically, bit commitment is a primitive in 
which Alice commits to a certain bit while this bit should 
remain hidden to Bob until Alice later reveals its value. 
In the first stage, called "commit phase" , Alice locks her 
bit in such a way that it is hidden, and sends it to Bob. 
The protocol is said to be "concealing" if Bob cannot 
cheat by learning information about this bit before the 
second stage. In this second stage, called "unveil phase" , 
Alice sends information to Bob so that he can unlock the 
bit and find its value. The protocol is said to be "bind- 
ing" if Alice cannot cheat by changing the value of the bit 
once she has committed to it. A bit commitment proto- 
col is secure if it prevents Alice and Bob from cheating, 
that is, if it is both binding and concealing. 

The original proof of the impossibility of QBC due to 
Mayers consists of two steps [2,]. In the first, which is 
the most subtle one and will not be discussed here, one 
shows that the security of any QBC reduces to the secu- 
rity of a generic QBC scenario as described hereunder. 
The second step is then to show that this generic QBC 
scenario, also known as a "purification" QBC protocol ^3,], 
is insecure 0]. In this scenario, Alice uses a bipartite 
Hilbert space Hp (E) Ht, which is the tensor product of 
the so-called "proof and "token" spaces. Alice chooses to 
commit the bit (0 or 1) and prepares one of the two 
orthogonal states \xb) in the total Hilbert space by ap- 
plying a unitary transformation Ub on a state \ip), that 
is, \xb) — Ublijj). In the Schmidt representation, these 
states may be written as 



In the commit phase, Alice transmits to Bob the token 
system lying in Ht, which is in state pb = irp\Xb){Xb\- 
In the unveil phase, Alice transmits to Bob the proof 
system lying in Hp, so Bob can determine the value of 
the committed bit b by projectively measuring the state 
\Xb) using orthogonal projectors. Now, the insecurity 
of this generic QBC protocol against cheating can eas- 
ily be proven. The requirement that Bob gains no in- 
formation before the unveil phase simply translates into 
pi ~ po, or equivalently \t'/) = \ti) (up to a phase) and 
a[ = fli, Vi. Remarkably, if this condition is fulfilled, Al- 
ice can perfectly cheat after the commit phase by chang- 
ing — > with some appropriate unitary trans- 
formations C/p (8) 1 on her proof system. This implies 
that quantum bit commitment cannot be both perfectly 
concealing and binding 0, 0] . 

This proof leaves open the possibility that if certain 
restrictions are imposed on the operations available to 
the parties, a QBC may be constructed that is secure or 
at least partially secure. There is some literature on this 
topic for both classical and quantum bit commitment (see 
for instance [1| and references therein, or 041]), with pos- 
itive and negative results. What we shall examine here 
is a simpler and less studied scenario, where restrictions 
are imposed on Alice's cheating operations only. One can 
easily construct a secure QBC that falls into this cate- 
gory: simply encode the committed bit into a subspace 
of the total Hilbert space that remains invariant under 
Alice's permitted local transformations on the proof sys- 
tem. To illustrate this idea, let us give a trivial example 
using a system consisting of two spin-1/2 particles. Let 
us encode and 1 into the eigenvalue of the total spin 
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S2 = (Si + Ss)^ by choosing 

|xo) = k = 0,m = 0) = (|t) ID -ID It)) /v^ 

IXi) = \s = l,m = 0) = (It) It) + It) It)) /V2 (2) 

where s stands for the total spin quantum number and 
TO for the quantum number associated with its projection 
onto the z axis. It is obvious that the condition pi = po 
is satisfied and that the protocol is not secure if Alice has 
all local operations (i.e., the algebra SU (2)(g)l) at her dis- 
posal. However, let us suppose that her local operations 
are restricted to a subgroup of SU{2) 1 that commutes 
with S^. For the case of spins there is no such subgroup, 
but one can still restrict Alice to use the trivial operation 
generated by Si, that is, a rotation around the (1, 1, 1) 
vector in the Bloch sphere representation. Under this 
restriction, the protocol becomes secure since cheating 
would require a rotation around the z axis or (0, 0, 1) vec- 
tor, i.e., an operation known as a "phase gate" in which 
It) remains unchanged while \D gets a minus sign. 

This example is rather unrealistic since there is no ob- 
jective reason for justifying this restriction on Alice's lo- 
cal operations while, in the total Hilbert space Hp (g) Ht, 
she can apply the global operations that generate \xb) as 
defined in Eq. ([2]). On the contrary, in the QBC scheme 
that we introduce in this paper, it will appear that a 
specific constraint on Alice's cheating operations can be 
experimentally well motivated, giving rise to an asymp- 
totically secure protocol. We will devise a "continuous- 
variable" QBC protocol based on quantum states lying 
in an infinite-dimensional Hilbert space, which can be 
realized as states of the electromagnetic field (see, e.g., 
d, [l3|)- In this quantum optical QBC protocol, we shall 
assume that Alice is restricted to carry out Gaussian op- 
erations only, which is consistent with the current exper- 
imental ability to engineer quantum states of light in a 
deterministic way. Only a few very challenging exper- 
iments have been successful to prepare and manipulate 
non-Gaussian states of traveling light (see, e.g., [Il|-[l6|). 
and all of these schemes arej3ased on heralded photon 
subtraction or addition US], hence are probabilistic 
in nature. A deterministic non-Gaussian operation would 
require high optical nonlinearities that are not accessible 
in the laboratory today. Since probabilistic cheating does 
not endeavor the security of QBC if the success probabil- 
ity is low (this even holds true otherwise, though in the 
asymptotic protocol only), such a restriction to Gaussian 
cheating operations is justified in the context of QBC. 

Thus, although it is not impossible, in principle, to re- 
alize deterministic non-Gaussian optical operations based 
on giant nonlinearities, there is a natural boundary 
separating the Gaussian from non-Gaussian determinis- 
tic operations, and it is relevant to investigate a QBC 
scenario where Alice is not allowed to carry out non- 
Gaussian cheating operations. This scenario has been 
introduced in Q, where a strong "no-go theorem" was 
derived: secure quantum bit commitment is forbidden in 
continuous-variable protocols where both players are re- 
stricted to use Gaussian states and operations. In other 



words, if the protocol is built on Gaussian states \xb), it is 
sufficient for the players to carry out Gaussian operations 
in order to cheat perfectly. Therefore, it was concluded in 
^ that a secure QBC protocol with Gaussian constrained 
cheating, if it exists, should necessarily be built on non- 
Gaussian states \xb)- In the present paper, we prove that 
this holds by exhibiting an explicit secure non-Gaussian 
QBC protocol. It should not be viewed as a directly us- 
able QBC protocol since, as we will see, it still requires 
the use of either a quantum memory or a very long time 
delay in an optical interferometer. Instead, our goal is to 
point towards a conceptual method to reach asymptotic 
security in continuous- variable QBC under Gaussian con- 
straints. A restricted proof-of-principle demonstration of 
this protocol seems nevertheless feasible within the cur- 
rently available technologies. 

In Section [Hi we define our QBC protocol and ana- 
lyze first how it works when the two parties are honest. 
In Section Hill we go beyond the honest scheme and in- 
vestigate Alice's best possible cheating if restricted to 
Gaussian operations. In Section IIVI we consider Bob's 
cheating, which allows us to probe the trade-off between 
Alice and Bob's cheating. In Section |Vl we suggest an 
improvement to the scheme in order to make it asymp- 
totically secure, while we conclude in Section IVTl 

II. THE HONEST SCHEME 

Let us consider the following purification protocol Q 
in an infinite-dimensional Hilbert space, which is in di- 
rect analogy with the above-mentioned spin-1/2 example. 
The and 1 values of the committed bit b are encoded 
into the orthogonal two-mode non-Gaussian states, 

Ixo) = (l«) |-«) - h«) H) /y'2(l-e-4IH^) 

Ixi) - (|«) ha) + ha) |a)) /^2 (l + e-^l-l^) (3) 

where \a) — D {a) |0) — exp (aat — a*aj |0) is a coher- 
ent state of complex amplitude a. Moving from orthogo- 
nal qubit states |0) and |1) in a two-dimensional Hilbert 
space to near-orthogonal coherent states \a) and ha) 
(a 3> 1) in an infinite-dimensional Hilbert space has al- 
ready been put forward in the context of quantum com- 
putation [l^H^I, and our treatment of QBC follows on 
this. Note that the states of Eq. ^ correspond to entan- 
gled "Schrodinger cat" states, whose experimental gener- 
ation has recently been demonstrated in [2l| . 

Let us suppose that a > 2 (in practice, this is suffi- 
cient to be very close to the asymptotic situation where 
I a) and |— a) are orthogonal). One of the two modes (to- 
ken system) of state \xb) is sent to Bob in the commit 
phase, while the second mode (proof system) is kept by 
Alice. At this stage. Bob can almost not distinguish be- 
tween ho) and hi) whatever measurement he uses since 
pi ~ Po- On the other hand, it is immediate to see how 
Bob can distinguish between these mutually orthogonal 
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states \xb) in the total Hilbert space during the unveil 
phase. Consider the two modes of |xf,) as incident beams 
on the two ports of a balanced beam splitter, effecting 
the unitary operation B. By adjusting the phases, the 
outgoing state |xb) — B \xb) can be written as 

IxJ,) = da') - |-a'» |0) /v/2(l-c-2|"'l^) 

1x1) = da') + ha')) |0) 7^/2 (1 + 0-21"'!^) (4) 

which is the tensor product of a "Schrodinger cat" state 
of amplitude a' = \f2a and the vacuum state. Note 
that the cat state is odd (even) for 6 = (& = 1). The 
states Ix'f,) are perfectly distinguishable by applying a 
photon number parity measurement on the first mode, 

corresponding to the observable P = (—1)" °, that is, 

(Xol^®l|Xo)=-l, (x'i|/'®l|x'i) = l (5) 

Note that this measurement may be realized by photon 
counting using a number-resolving photodetector as has 
very recently become available (see, e.g., [22l |23() 

Now, we are ready to describe the honest QBC proto- 
col as illustrated in Fig. [TJ In the commit phase, Alice 
prepares one of the states |x't,) as defined in Eq. Q ac- 
cording to the value of the bit h she wants to commit. Us- 
ing a balanced beam splitter, she converts |Xf,) into \xb) 
as defined in Eq. ([3|) , and then sends the token mode (in 
state ph) to Bob. In the unveil phase, she sends the proof 
mode to Bob, which he combines with his token mode in 
a balanced beam splitter to obtain the unentangled state 
IXb) as originally held by Alice. Finally, Bob discards the 
mode corresponding to the vacuum state and performs a 
parity measurement on the cat state in order to unveil 
the value of bit h. We assume that the interferometric 
scheme is perfectly balanced and that the holding phase 
(the period after the commit phase but before the unveil 
phase) can be achieved by inserting equal time delays in 
the two branches of the interferometer. Ideally, a quan- 
tum memory should of course be available to Bob in order 
to achieve a longer-time holding phase. 



III. ALICE'S BEST CHEATING STRATEGY 

Let us first assume that the QBC protocol is conceal- 
ing, that is, secure against any measurement by Bob try- 
ing to cheat during the holding phase. In other words, 
we assume that the coherent state amplitude a > 2, so 
that pi ~ po- Under this assumption, which we will make 
rigorous in Section |IVl we can investigate the security of 
the protocol against Ahce's cheating strategies. 

A. Non-Gaussian cheating 

Obviously, if all local operations on the proof mode 
were available to Alice, then she could convert the value 
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FIG. 1: Honest protocol. The state |cat) can either be an even 
or an odd Schrodinger's cat state of amplitude a' depending 
on the bit b to be committed, see the first mode in Eq. Q. 
The token mode is transmitted in the commit phase, while the 
proof mode is transmitted in the unveil phase. Bob combines 
the two modes at a balanced beam splitter and measures the 
photon number parity in the first mode. 

of her committed bit at will during the holding phase. 
However, this would require her ability to perform a no- 
tably non-Gaussian local operation, where \a) remains 
unchanged while \—a) gets a minus sign. Such an op- 
eration, which can be viewed as the continuous-variable 
analogue to the phase gate that we referred to in the case 
of spin-I/2 particles, corresponds in the limit a ^ 1 to 
the non-Gaussian unitary 

Ung = D{-a)eiip[iTT\0){0\]D{a) (6) 

It cannot be implemented deterministically with accessi- 
ble optical nonlinearities, so for cheating one would have 
to turn to probabilistic schemes based on heralded pho- 
ton subtraction, whose probability of success is very low 
[13, UHl- Therefore, we may fairly impose such a Gaus- 
sian restriction on Alice's cheating operation in the hold- 
ing phase (or assume that the probability of success of 
such a non-Gaussian local operation is negligible). 

One may rightly argue, of course, that within the cur- 
rent experimental settings, the generation of Schrodinger 
cat states as needed in Ahce's preparation of \xb) can- 
not be deterministic either. However, during the commit 
phase, Alice can determine whether |x[,) has been suc- 
cessfully prepared or not, and, if not, she can repeat the 
operation again until it is successful (or send the state to 
Bob but later notify him of the failed trial). Thus, the 
probabilistic occurrence of a failure is not detrimental 
to the commit phase, while it prevents an efficient non- 
Gaussian cheating. In other words, the Gaussian restric- 
tion we impose on Alice's cheating operations is justified 
within the present experimental limitations, while, at the 
same time, Alice's preparation of the non-Gaussian state 
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IXb) needed to overcome the no-go theorem Q can very 
weU be done probabilisticaUy. 



B. Gaussian cheating 

The essential question to be answered now is to find 
the best cheating strategy for Ahce if only Gaussian op- 
erations are available to her. Here, "best" should be in- 
terpreted according to the unveil procedure that has been 
defined for the honest protocol, that is, when Bob uses a 
balanced beam splitter and performs a parity measure- 
ment on the first mode. If, when Alice cheats, Bob recon- 
structs the state |x'^) at the output of his beam splitter 
while Alice had initially committed \x'bli the best cheat- 
ing strategy is obviously the one where (x^-P ® 
reaches the closest value to {x'^^}P ® l|x^;,), where ^6 is 
the complement of the bit b. The probability of success 
of the best Gaussian cheating strategy can be measured 
with Alice's "maximum control" Cmax, as defined in Q. 

Let us review the operations available to Alice. The 
most general Gaussian unitary operation Uq on a sin- 
gle mode is an exponential of a linear combination 
of the elements of the two-photon algebra /ig, namely 

|l, a, a^, a\ ,1/2-1- a^a|, so it relies on 6 real param- 
eters. This general Gaussian transformation can also be 
casted as a sequence of standard optical operations, for 
instance [261 



UG = D{P)U{^)S{r)U{e) 



(7) 



where S (r) = exp (a^ — a^^)] is a squeezing of param- 
eter r of the X quadrature, U (9) = exp {\9a)a) is a phase 
rotation of angle 9, and D {(i) = exp (/3o'f — /3*a) is a dis- 
placement of complex coherent amplitude /3. We ignore 
the global phase operation, which plays no role here. 

The information about the committed bit b is encoded 
into the parity of the first mode of Ixf,): or, adopting a 
phase-space point of view, in the interference pattern of 
the Wigner function {h— 1), 



1 r°° 

W {x,p) ^ — J exp{ipq) 



(8) 



Note that the quadrature variables {x,p) in phase space 
are defined here using the convention a — {x + ip) / ^/2. 
This phase-space interpretation, which will be very useful 
in the following, originates from the relation between the 
mean parity and the Wigner function at the origin in 
phase space, namely 



1^(0,0) = -(P). 

TT 



(9) 



The interference pattern of the Wigner function of the 
Schrodinger cat state |Xf,) ~ hence the parity information 
- is smoothed out during the commit phase since Alice 
looses a handle on the token system, and it is revived 



in the unveil phase once the token and proof systems 
can be measured jointly. One can visually understand 
this smoothing out procedure by comparing the Wigner 
function of the first mode in Eq. Q during the commit 
phase (before the beam splitter) with the Wigner func- 
tion of the traced out mode in Eq. ([3]) during the holding 
phase. What we need to analyze is the effect on the mean 
parity (P) of the first mode of IxJ,) when Alice applies 
any Gaussian unitary Ua on the proof mode of |xb) ■ The 
most general operation is actually a Gaussian GP map, 
but we will argue later on that the best cheating is nec- 
essarily a Gaussian unitary. 

In the simplest scenario, involving displacements only, 
Alice can for example displace the proof system by d 
along the positive p quadrature direction. In the unveil- 
ing phase. Bob will then get the initially committed cat 
state displaced by —d/ a/2 along the p quadrature, where 
the factor \/2 is due to the second beam splitter. In 
other words, Alice can alter the parity of the unveiled 
state by freely displacing the origin of phase-space to an- 
other point of the interference pattern where the Wigner 
function has another value, even possibly the opposite 
sign. We will now prove that this simplest scenario ac- 
tually provides the best Gaussian cheating strategy for 
Alice, so that no squeezing or phase-rotation is helpful. 

The key observation is that the most general Gaussian 
unitary of Eq. (O corresponds to a special case of an 
affine transformation in phase-space [27| , namely a linear 
symplectic transformation followed by a translation. In- 
tuitively, this means that the Wigner function of the ini- 
tial state may be displaced, squeezed, or rotated, but its 
maximum and minimum values Wmax.min remain invari- 
ant under these operations. Alternatively, using Eq. 
this means that the maximum and minimum values of 
the mean parity (P)max.min that can be reached under 
Gaussian unitaries are invariant for a given input state. 
They can be reached simply by translating the Wigner 
function in such a way that the origin is moved towards 
the highest peak or the deepest dip in phase space, re- 
spectively, with no squeezing or rotation needed. 

Remember that, when cheating, Alice can only apply 
her Gaussian operation on the proof mode, not on the 
token mode. However, since Bob only checks the first 
outgoing mode of his beam splitter (the one containing 
the cat state whose parity encodes b), an arbitrary dis- 
placement on this mode can be achieved via a displace- 
ment of the proof mode only, so Alice can indeed freely 
translate the Wigner function of the cat state. Now, 
leaving displacements asides, if Alice's cheating opera- 
tion involves a rotation or squeezing operation, the out- 
going modes of Bob's beam splitter become inevitably 
entangled, so the unveiled state becomes mixed. Since 
mixing can only wash out the interference pattern, the 
maximum parity (P)max can only decrease while (P)inin 
can only increase. Thus, rotation and squeezing can only 
make cheating worse, and are useless to Alice. The same 
reasoning also implies that a Gaussian CP map cannot 
do better than a Gaussian unitary since it eventually im- 



plies tracing over some ancillary system after applying a 
Gaussian unitary onto the joint system, hence smearing 
out the Wigner function. 

This confirms that Alice's best Gaussian cheating 
strategy for reaching the target bit value — (1) is by 
displacing her proof system so that Bob obtains the orig- 
inally committed cat state \x[i) displaced in such a way 
that the minimum (maximum) value of its Wigner func- 
tion Wmin (Wmax) IS uow locatcd at the origin. Perfect 
cheating wih be achieved if Wmin = — 1 {Wmax—^)- 



C. Alice's maximum control Cmax 

To illustrate this optimal Gaussian cheating, suppose 
that Alice has initially committed the bit 6 = (odd 
Schrodinger cat with (xol-P Mx'o) — ~1) and at- 
tempts to cheat during the holding phase so that Bob 
would measure a bit = 1 (even Schrodinger cat with 
(x#l-f ^\x'#) ~ ^) '^^ unveil phase. The optimal 
cheating strategy is easy to understand in Fig. [2l where 
we have plotted the Wigner function of the initially com- 
mitted cat state. Alice needs to displace her proof system 
by along the p quadrature, so that \x'#) becomes the 
original odd cat state displaced by —d along the p quadra- 
ture (equivalently, the origin of phase space is shifted 
upwards by d as illustrated by an arrow in Fig. [5]). The 
parameter d is just the distance (along the p quadrature 
direction) from the origin to the first maximum of the 
interference pattern, which is also the global maximum 
of the Wigner function. 

For a cat state of amplitude a' there is no analytical 
expression for d as a function of a' , and one has to nu- 
merically solve the equation 



pcos 



2%/2; 



pa 



+ V2a sin (2V2pa' 
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-2a ■ 



(10) 



for p. The best cheating is then a displacement by d, 
which corresponds to the smallest positive and non-zero 
solution of Eq. pUj) . Let us analyze precisely the effect 
of such a cheating in the specific example of Fig. [2l that 
is, when Alice commits an odd cat state of amplitude 
a' = 3/V2. By solving Eq. (HO]), we get that the best 
Gaussian cheating requires a displacement of d = 0.496. 
The corresponding photon number distributions with and 
without cheating are schematically presented in Fig. |31 
where we observe that the distribution with cheating 
qualitatively resembles the target distribution. 

The probability of success of this best Gaussian cheat- 
ing strategy can be measured with Alice's "maximum 
control" Cmax as defined in Q, that is, the largest differ- 
ence between Alice's probability of unveiling whatever bit 
she wants when she is cheating and when she is honest. 
Assuming that the bit she wishes to unveil is equiprob- 
able, this can be expressed as one half of her cheating 
probability. Using the relations (P) = (-P+) — (-P-) and 
(P+) -|- {P-) = 1, where (P_|_(_)) stands for the probabil- 
ity to measure an even (odd) number of photons at the 
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FIG. 2: Contour plot of the Wigner function of an odd 
Schrodinger cat state of amplitude a' = 3/\/2. Bob obtains 
this state in the unveil phase if Alice has committed the bit 
and has not cheated. The best cheating strategy for Alice 
during the holding phase is to displace her proof system by 
\/2d along the p quadrature, so that the unveiled state is dis- 
placed by —d (or the origin in phase space is shifted upwards 
by d, as illustrated by the arrow). Then, the origin of the un- 
veiled state is located on the global maximum of the original 
Wigner function. For an even Schrodinger cat, the situation 
is exactly analogous. 



displaced origin, we can deduce (P_|_(_)) from the mean 
parity at the displaced origin (P) = 7rW^(0,d). Since 
Alice had committed a bit 6 = 0, here (P+) is the proba- 
bility that she successfully cheats and unveils a bit 6 = 1 . 
Thus, in the present case, we get 



Cn- 



1 



1 



HP) 



1) 



0.443 



(11) 



The success probability of Alice's optimal Gaussian 
cheating Cmax increases with the amplitude a' since the 
contrast in the interference pattern of the Wigner func- 
tion of the cat state becomes stronger. In Fig. SI we 
illustrate this dependence as derived numerically. Note 
that for small values of a', there is a different behav- 
ior for odd and even cats related to the fact that their 
mean photon number significantly differs (the even cat 
tends to the vacuum state |0) as a' — ?> 0, while the odd 
cat tends to the first number state |1)). For large val- 
ues of a' {> 3/2), it can be analytically shown that the 
dependence simply scales as Cmax — exp(— 7r-^/8Q;'^)/2, 
that is, Cmax tends to 1/2 with a difference following 
a polynomial dependence in 1/a'. This feature will be 
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FIG. 3: Photon number distribution for (a) the committed 
cat state (a = corresponding to bit 0; (b) the state 

achieved by Alice's best Gaussian cheating strategy; and (c) 
the target state corresponding to bit 1. The symbol (P) de- 
notes the mean photon number parity, while Cmax denotes 
Alice's maximum control. 



crucial in Sec. |Vl where we consider the asymptotic se- 
curity of the protocol. It is simply obtained by using the 
approximation d « n/ {2\/2a'), resulting from the fact 
that in this limit the global maximum (minimum) ap- 
proximately coincides with the maxima (minima) of the 
oscillating interference term cos 
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FIG. 4: Alice's maximum control Cmax (one half of the 
success probability of her optimal Gaussian cheating) as a 
function of the coherent amplitude a'. For small values of a' 
i'^' ^ 3/2), on the left of the vertical grey bar, the committed 
even and odd cat states behave differently, that is, C^lx 7^ 
C^max- We also plot C^iax) Alice's maximum control when the 
vacuum mode is also monitored by Bob in the unveil phase, 
for both an initially committed even and odd cat state. Bob's 
maximum information gain Gmax (one half of the probability 
of successfully determining the committed bit) is also plotted 
as a function of a'. 

Interestingly, Alice's maximum control Cmax can be 
further reduced if, during the unveil stage. Bob also ver- 
ifies that the second outgoing mode of his beam splitter 



is in the vacuum state |0) as it should be in the absence 
of cheating. If Alice applies the above optimal Gaus- 
sian cheating during the holding phase, the second out- 
going mode experiences the same displacement as the cat 
state, so that the probability that no photon is detected 
is PnoP = cxp {—(P/2). This was irrelevant in the above 
calculation of Cmax as Bob disregarded the second mode 
in the unveil phase. However, one can make use of this 
fact and measure the second mode with photon count- 
ing in order to further improve the security of the pro- 
tocol since the probability of successful cheating is then 
reduced to C'^^^ — Cmax x PnoP- We present the mod- 
ified curve Cmax ill Fig. |4] with dashed lines. It must be 
stressed, however, that the optimal cheating strategy we 
derived in the original protocol (without monitoring the 
second mode) does not necessarily remain optimum for 
this modified protocol. Finding the optimal Cmax 
open problem. 

It is important to mention here that throughout our 
analysis, we have only considered the case where Alice 
applies her cheating operations during the holding phase. 
Alice could as well cheat in the commit phase already by 
commiting a state that is different from the state |Xi,) of 
Eq. (HI) and try to change it during the hold phase. An ex- 
ample of such a successful cheating strategy would be to 
commit a state of amplitude a higher than the one agreed 
upon and displace her proof mode at will during the com- 
mit phase. In this way, and if a 3> 1, she could obviously 
achieve Cmax asymptotically close to 1/2. However, the 
detection of such a cheating during the commit phase 
could easily be detected in the asymptotic protocol that 
we suggest in Sec. |Vl 



IV. BOB'S BEST CHEATING STRATEGY 

In the previous Section, we have assumed that the am- 
phtude a was large enough to guarantee that the protocol 
was perfectly concealing. We will now make this state- 
ment more accurate, and determine the relation between 
a and Bob's maximum information gain Cmax (as defined 
in 3) during the holding phase while assuming that Al- 
ice is honest. The most appropriate measure to quantify 



Cmax uses the trace distance |28|] 



-D(po,Pi) = ^Ti'Ipo - Pi\ 



(12) 



which corresponds to the probability of successfully dis- 
tinguishing the two quantum states with the best POVM 
measurement, so-called Helstrom measurement poj . If po 
and pi correspond to the single-mode reduced states of 
\Xq) and \xi) from Eq. ([3]), it is easy to show that 



Po - Pi 



ii\a) {a\ 



-a 



-a\) 



s'\'^\\\a){-a\ + \-a){a\)). (13) 
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It remains to find the eigenvalues of the Hermitian matrix 
H = Pq — pi, which is not a difficult task once we observe 
that it can be rewritten in terms of cat states, 

i/ = A+|+)(+| + A_|-)(-| (14) 

with |±) = {\a)±\-a)) /y^2(l±e-2|"l') and A± = 
ie^l"!'/ (^1 + e4|°l'y It then follows that 

Tr|i/| = 2e2|"lV(l + e^l"l') (15) 

and 

1 e-2|"l' 
^"-^ 2^^^°'^^^^ 2(l+e-4|"P) - ^^^^ 

This implies that Bob's capability to optimally distin- 
guish between the two states decays exponentially with 
a, analogously to the behavior of the overlap {a \—a). In 
Figure 21 we have also plotted Gmax as a function of the 
amplitude of the committed cat state a' — \/2a, which 
illustrates this exponential decay. We observe a trade-off 
between Alice's cheating and Bob's cheating: the more 
control Alice has on the committed state (large Cmax), 
the less information Bob is able to gain (small Gmax)- 
This trade-off is exhibited in Fig. [SI where we plot Cmax 
versus Gmax for an initially commiteed odd cat state (bit 
0). For comparison, we also plot the (not necessary reach- 
able) lower bound on this trade-off for QBC protocols as 
derived in Q (we refer the reader to Ref. [s^l for some re- 
cently obtained results on the exact bounds). It appears 
that, while our protocol as such cannot be both perfectly 
concealing and binding (there is no value of a such that 
Gmax and G,nax tend to zero simultaneously), it enters 
(for a' ^ 3/2) in the area that is not accessible to QBC 
protocols without restrictions. 

V. ASYMPTOTICALLY SECURE PROTOCOL 

The fact that Bob's maximum information gain Gmax 
is exponentially decreasing with a' while the success 
probability of Alice's best Gaussian cheating Gmax is only 
polynomially increasing with a' can be exploited to im- 
prove the security of our QBC protocol in a similar man- 
ner as in the original QBC protocol of Ref. [3l| . 

This is achieved by modifying the setting of Fig. [T] and 
use a sequence (a tensor product) of N identical states 
\x'b) instead of a single one for the encoding. In this 
modified scheme, we may assume that Alice's best Gaus- 
sian cheating strategy factorizes. A collective Gaussian 
attack on N states cannot increase the maximum value 
of the total Wigner function of the N states, and there- 
fore it cannot give a better cheating on average. With 
this argument, we can estimate that her maximum suc- 
cess probability is simply Gnilx = 2^~^ (Gmax)^ since 
the cheating remains undetected only if all N states are 



'-'max 

0.5 r 




max 



FIG. 5: Solid red (blue) line: Alice's maximum control 
Cmax -Odd veisus Bob's maximum information gain Gmax for 
a' > 3/2 (a' < 3/2). Dotted black line: Lower bound on the 
Cmax versus Gmax trade-off for QBC protocols as derived in 



successfully controlled by Alice. Hence Gmax decreases 
exponentially with N. In contrast, assuming that entan- 
gled measurements are of no use, Bob's maximum in- 
formation gain becomes G^aL = (l — (1 — 2Gmax)^) /2 
since (1 — 2Gmax) is the probability of not distinguish- 
ing the states. Hence, G^,Jlx increases linearly (at most 
polynomially '28'|) with the number of states N provided 
that Gmax is small {a' is large). 

Then, by choosing a large amplitude a' so that Gmax 
is exponentially small, Gnilx can be made exponentially 
small as well by choosing a large enough N (not too large 

to keep G^x small, which is possible given the linear 
scaling). In this way, we can construct a QBC protocol 

that is asymptotically secure in the sense that G^iilx — > 
and Ci^el 0. 

As a matter of concreteness, we plot in Fig.lHlthe value 
of Gnmx versus G^aL for different values of the coherent 
amplitude a'. For a given a', the point moves to the 
right for increasing N, and we tend to a protocol where 
Alice cannot cheat anymore while Bob is able to cheat 
perfectly. If the value of a' is increased, the starting 
point for = 1 corresponds to a better control for Alice 
and a lower information gain for Bob. Then, if a' is 
taken large enough, we can reach an interesting region 
where both G^i and G^idx are small by choosing an 
appropriate large value of N. 

In practice, achieving really small values of Gmax and 
Gmax is probably not possible within the current available 
technology. For instance, a security of the order of 10~^ 
would requires a' « 4 and N ^ 300. More realistically, a 
value of Gmax and Gmax of the order of 10 ~^ would only 
require a' w 2 and N « 10, which may be feasible if the 
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FIG. 6: (a) Alice's maximum control Cmax versus Bob's max- 
imum information gain G^2i for different amplitude a' . (b) 
The same plot in logarithmic axes. 

TV committed cats states are sent iteratively. For = 1, 
as can be seen in Fig. [SI we are far from the secure 
region as Cmax remains too large. It may be interesting, 
however, to demonstrate this protocol for N = 1 and 
a' ^ 3/2 as it then beats any possible QBC protocol 
with no restriction Q, as already mentioned. 

The asymptotic protocol can also efficiently protect 
against cheating strategies of Alice during the commit 
phase if the parity measurement at the unveil phase is 
replaced by photon-number counting. In this case, by 
measuring iV ^ 1 states. Bob obtains the photon-number 
distribution of the commited state and thus may eas- 
ily conclude if Alice has initially commited another state 
than than the states \x'h) of Eq. For instance, in the 
case where Alice decides to commit a state of amplitude 
a higher than the one agreed upon, the photon-number 
distribution obtained by Bob will have a mean that is 
higher than expected. 



Note finally that if the vacuum mode is monitored in 
the unveil phase and if for this modified protocol the 
Gaussian cheating strategy we have examined is proven 
to be the optimum, then Cmax may be further reduced 
by a significant factor. The maximum information gain 
Cmax is also cxpccted to be, in practice, less than the 
values we have calculated since Helstrom measurements 
for continuous variables require the use of non-Gaussian 
resources. Finding an operational measurement scheme 
realizing the POVM described in Section IIVI or finding 
a (more convenient) tomographic procedure for ^ 1 
that achieves the maximum information gain is another 
open question. 



VI. CONCLUSIONS 

We have investigated continuous-variable QBC proto- 
cols with Gaussian constraints. It had been proven in a 
recent work [§1 that restricting both parties to Gaussian 
states and operations cannot lead to a secure QBC pro- 
tocol. Here, we have gone one step further and have in- 
troduced a QBC protocol that is based on non-Gaussian 
(Schrodinger cat) states of light, thereby circumventing 
such a Gaussian no-go theorem, but that still imposes a 
Gaussian restriction on Alice's cheating operations. This 
continuous- variable QBC protocol is shown to be asymp- 
totically secure in the sense that Alice's control and Bob's 
information gain can be both made arbitrarily small. 
Even though the Gaussian restriction we put on Alice 
is not of a fundamental nature, the non-Gaussian deter- 
ministic operations as needed by Alice in order to cheat 
would require high optical non-linearities that are inac- 
cessible today in the laboratory. In contrast, the prob- 
abilistic procedures that can effect non-Gaussian opera- 
tions based on post-selection, as already demonstrated in 
the laboratory, can be used by Alice in order to prepare 
the cat states that are necessary to initiate the protocol. 

In conclusion, we envision that a restricted proof- 
of-principle demonstration of this continuous-variable 
QBC protocol may become realizable within the near- 
future state of technology given the recent experimental 
progress on non- Gaussian state of light generation pTI - 
l23j . An interesting extension of this work would be to 
devise more practical continuous- variable QBC protocols 
going beyond the purification protocol investigated here, 
but instead following the lines of the original QBC pro- 
tocol of Ref. [3l| for discrete variables, for which no en- 
tanglement or quantum memory is required. 
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